Privacy policy

This website is run by Flagstaff Mountain-Town Market LLC in Flagstaff, Arizona, the company behind the Flagstaff Mountain-Town Market and, with Proof Bread and the City of Tempe, the Tempe City Hall Farmers Market. Most visitors only read the schedule, and nothing here applies to them beyond the analytics section. The rest of this page is for vendors, volunteers and performers who apply through the site and use the vendor portal, because we hold real information about you and you should know exactly what, why and for how long.

Questions, corrections and deletion requests go to flagstaffmountaintownmarket@gmail.com.

What we collect, and why

Vendor and volunteer applications

The applications on this site (the Flagstaff Mountain-Town Market vendor application, the City Hall Saturday application run with Community Assistance Teams of Flagstaff, and the Tempe City Hall Farmers Market vendor, volunteer and performer applications) collect what you type into them: your business or organization name, your name, email address and phone number, what you sell or offer and where people can find you online, the market dates you want, the fee option and payment method you prefer, and the licenses, permits, insurance and tax numbers the rules require. Some applications ask for a mailing address so we can send payment instructions; it is stored for the market managers only and is never shown anywhere else, including in the vendor portal to other vendors. Agricultural applicants may describe their crop plan and agree to a farm, ranch or homestead inspection. The Tempe volunteer application asks whether an activity involves children, because the City of Tempe requires a fingerprint clearance card for those activities.

Each application ends with an indemnity agreement and a set of market rules. You sign by typing your name and the date. We store that typed signature, the time you submitted it and the exact text you agreed to, and you can read it again in the portal under Rules and agreements.

We use all of this to review your application, decide and tell you the outcome, set up your dates, bill the fees you chose, keep the documents the rules require current, and run the market day. We do not use it for anything else and we do not sell or rent it.

End-of-market reports

After each market day, vendors file an end-of-market report: gross sales for the day, the sales fee the site computes from that figure, how you paid it, optional feedback and an optional 1 to 5 rating. The market managers use the figures to settle the day and the feedback to run a better market. The rules on the application describe how sales may be audited.

Payments

This site does not take card payments. When you pay by Venmo, Zelle, PayPal, check or cash you report the amount, date and reference in the portal, and a market manager confirms it and issues a receipt number. We never see or store card numbers or bank details. If online card payment is added later it will go through a payment processor under its own privacy policy, and this page will say so before it is switched on.

Protecting the forms

Each submission records a one-way salted hash of your IP address and your browser's user-agent string. The hash lets us limit each address to twelve submissions an hour; it is not your IP address and is not used to identify you. Every form also has a hidden field that only automated software fills in; submissions that fill it are discarded.

Emails we send

The site sends email from hello@flagstaffmountaintownmarket.com through Cloudflare's email service. You will get a confirmation when we receive your application, the decision when it is made, set-up details if you are approved, a reminder about 48 hours before each market you are booked on, a link to your end-of-market report about 15 minutes after the market closes, reminders if that report is still open, a note when a market you are booked on is cancelled, receipts for confirmed payments, and the one-time sign-in codes you request. Market managers receive a copy of each new application and a weekly digest; the organizer copy of a Flagstaff application goes to flagstaffmountaintownmarket@gmail.com and of a Tempe application to tempecityhallfarmersmarket@gmail.com. These are operational messages about your own application and dates, not a marketing list, and there is no newsletter sign-up on this site.

The vendor portal and sign-in

Applicants get a private status link that works for 90 days. Approved vendors sign in to the portal with an emailed link and a six-digit code that expires after 15 minutes; there are no passwords. Links, codes and session identifiers are stored only as cryptographic hashes, so a copy of our database could not be used to sign in as you. Expired sign-in codes are deleted after seven days and expired sessions after 30 days. Inside the portal you can edit your own contact details, helpers, products, set-up notes and mailing address, and update the identifier and expiry date of each document on file. Document identifiers are masked after you enter them.

Who can see your information

The market owner and the market managers (Meg for the Flagstaff markets, the Tempe co-manager for Tempe) see applications, rosters, payments and documents for the markets they run. They sign in through Cloudflare Access with their own accounts, and every decision, payment confirmation, cancellation and audit view is written to an audit log with their name and the time. Other vendors and the public never see your contact details; public and portal availability shows only whether a date is open or full. We share information outside the company only with the service providers below, or when the law requires it.

Where it lives

The site, its database and its email delivery run on Cloudflare. Applications, vendor records, bookings, charges, payments, settlements, documents and the audit log are stored in a Cloudflare D1 database that only the site's own code and the market managers can reach. Copies of the emails we send are kept for 90 days and then emptied; rate-limit records are deleted after two days.

How long we keep it

We keep applications and vendor records while you are a vendor with us and afterwards for as long as Arizona record-keeping and tax rules require for the fees you paid, the agreements you signed and the sales you reported. Email us to ask for a copy of what we hold, to correct it, or to have it deleted; we reply within a week and remove everything except the signed agreements and payment records we are required to keep.

Cookies and analytics

This site uses Google Analytics 4 to understand how people use it: the pages you visit, how you arrived (a search engine, a link or a direct visit), your device and browser type, an approximate location derived from your IP address, and two events of our own: which vendor channel you clicked (the application, the email address or Instagram) and which form you submitted. The form event carries only the form's name, never any answer you gave. Google Analytics sets first-party cookies (named _ga and _ga_ followed by an ID) that hold a random visitor identifier. They do not store your name, email address or anything you typed, and we do not use analytics data for personalized advertising.

The analytics script loads only on flagstaffmountaintownmarket.com, only after you first interact with the page or eight seconds after it loads, and never on the vendor portal or the admin pages. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser; the site works the same either way. There is no cookie banner because nothing on this site needs one: we set no cookies of our own and the portal uses a session cookie only while you are signed in.

Other services

The map page draws its tiles from OpenFreeMap, which receives the standard request data any server sees when the map loads. Fonts are served from this site, not from a font service. Links to Instagram, Facebook, Yelp, the City of Tempe and other sites take you to places with their own policies. The older vendor interest form linked from some pages is a Google Form and is covered by Google's privacy policy.

Children

The applications are for businesses, organizations and adults. We do not knowingly collect information from anyone under 18, and the only question about children is the Tempe volunteer question described above.

Changes

When we change what we collect, send or keep, we update this page and the date at the top in the same release. Vendors with an open application or booking are told by email about any change that affects them.

See also our terms of participation, the Arizona permits guide and the FAQ.